Tag Info

Hot answers tagged

46

There is no "patch". It's a vulnerability in the protocol, not a bug in the implementation. In Windows Server 2003 to 2012 R2 the SSL / TLS protocols are controlled by flags in the registry set at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols. To disable SSLv3, which the POODLE vulnerability is concerned with, ...


26

A person with administrative (or often even physical) access to a server is going to be able to extract the private key. Whether through exporting, memory sniffing, or other such trickery. Your administrators have access to the private keys of your web servers. Accept this as fact, and work around that. If your sysadmins aren't trustworthy, then you may ...


21

Just for ease of installation I derived this "disable ssl 2 and 3.reg" file from Evan's answer above: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server] "Enabled"=dword:00000000 ...


17

If you're not using IIS, you absolutely should remove it, for the reasons you mentioned - maintenance and security. The only effect of removing IIS is an inability to use IIS. No management or operational side effects - it hasn't been entrenched into the operating system like Internet Explorer has. Of the over 250 Windows servers I manage, less than 10 ...


16

No. Microsoft offers an FTP over SSL (FTPS) solution but does not currently provide a solution for securing FTP traffic using FTP over SSH (SFTP)


13

There are a number of things that could be causing this - unfortunately, we probably need a bit more information. Before I get into my actual response, just a quick point on your HTML pages: generally speaking, the application pool can only respond to a certain number of requests at a time. If it is busy responding to requests for dynamic pages, then it may ...


12

Neither the Microsoft IIS server, nor Windows itself, support SFTP (or SSH) at all, on any version of IIS or Windows. IIS supports secure FTP (FTPS or FTP over TLS/SSL) though. It's a different (incompatible) protocol than SFTP, but most "FTP" clients support both SFTP and FTPS. When setting up an FTPS server, make sure you disable plain (unencrypted) FTP! ...


11

When you import the key, you have the option of marking it as non-exportable. This will prevent you from using IIS or the certificate MMC to export it. At least, it makes it a little harder. However, if they have an administrator account on the machine, or have physical access to it - they will still be able to get the key through other means.


10

Powershell to disable SSL2 and SSL3: 2..3 | %{ New-ItemProperty -Path "HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL $_.0\Server" -Name Enabled -PropertyType "DWORD" -Value 0 -Force }


9

IIS is not required on any Windows system, unless you want to host web sites; the only exception is if you are using any server role which runs on web services (such as WSUS) or offers them (such as Certificate Services). However, if you actually have any dependency on IIS, Windows itself will warn you about this when you try to remove the role; if this is ...


9

Passive FTP requires that the FTP server have ports opened to it from the external network. Azure VM's use NAT, and thus needs extra configuration in order to support passive FTP. The (rough) checklist: Set the external VIP in the IIS FTP manager Set the port range to use (you might wanna show some moderation here - configuring thousands of ports are not ...


8

It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


8

To address the most basic part of your question: Yes, you can send commands to a Windows Server from a web interface using the PowerShell Web Access feature in Windows Server 2012 and 2012 R2. For what you want (linking a user control in a web page to the execution of a specific action on the server), you might want to look into executing PowerShell from ...


6

The trick would be to run the Apache and IIS on different ports (only one service can bind to one port at a time), though there's far from any guarantee that WSUS or ePO would work properly on non-standard ports. McAfee's support was correct in recommending not running the two things on the same server, though both pieces of software do have options for ...


6

Open your IIS manager and select the directory you want to protect. Under the "IIS" section select "Authentication". Disable "Anonymous Auth". Enable the desired Auth method (usually "Basic Auth") and it will be valid for this directory only. Add a User account. Give that user Read, Execute, List Permissions on the directory needed, then login via the newly ...


6

This is a bug in Chrome. You can see in the code that Chrome maintains a list of registry controlled domains and that it needs updated as each gTLD is added. You can see in the effective_tld_names.dat file that the .care domain is not listed, though its listed for other browsers that use a more recent version of the Public Suffix List. This is what causes ...


5

Here's a PowerShell that will test for the presence of the registry keys, create them if needed, and then enter the necessary values to disable SSL 2.0 and SSL 3.0 $regPath1 = 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\SSL 2.0' $regPath2 = 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\SSL ...


5

'USERTrust RSA Certification Authority' is not recognized as a root CA on all platforms. So, the best option is use it as an intermediate CA, having a certificate signed by 'AddTrust External CA Root'. You can retrieve this certificate at http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt Proper installation (most accepted) of your certificate is: Root ...


5

There is a free utility from Nartac that you can use to disable the protocols. https://www.nartac.com/Products/IISCrypto/Default.aspx


4

IIS provides a certificate chain to the client using the certificates loaded in the server computer's registry. You need to obtain the missing intermediate certificate and install it onto the server so that it can provide a complete certificate chain to clients.


4

In general, it's not a good idea to mix user data with application code. You should maintain these separately, as code lives better in a repo, while data lives in a DB or a "raw" storage system - very different ways of storing information. When you say "a ton" of documents, what does that mean? If you're looking at 100s of GBs in thousands of files, then a ...


4

You can use Microsoft's log parser utility. It has the capability of dumping into a SQL database as well as having the ability to create a checkpoint file so that it only imports records it hasn't processed. It can be used either as a stand alone executable or programmatically invoked via an ActiveX control


4

This is seems to be covered fairly well in install.txt included in the PHP zip downloads. Quoting from that file ... Manual Installation Steps ... Upgrading from a previous PHP version: Previous editions of the manual suggest moving various ini and DLL files into your SYSTEM (i.e. C:\WINDOWS) folder and while this simplifies ...


4

It seems that you are actually asking how to change HTTP ports in IIS. Open Internet Information Services (IIS) Manager (from Administrative tools) Connections pane: COMPUTER NAME Sites Default Web Site Actions pane: Edit Site Bindings... Just select the binding http->80 and edit it to meet your requirements. Repeat for any other sites bind ...


3

Not really knowing what server you are actually looking at we can only guess. Adding to what GregL and Jim B said. My guess is you're migrating from Server 2003 Standard, IIS 6.5, Access 2007 using ASP classic code pages connecting via OLEDB static. You might be planning on importing your Access using Upsizing Wizard (which kind of works most of the ...


3

You will want a load balancer in front of both. You can use apache load balancer (alb) serving on port 80. Setup IIS and apache web server on higher ports. Have the load balancer act as fail over not true load balancing. So alb listens on port 80 and any requests get proxied to IIS on a higher port (8181 for example). This way as soon as IIS is down alb will ...


3

Joseph's answer makes perfect sense, but it doesn't seem to work. The attribute 'serverAutoStart' on the site node in applicationHost.config is not changed. One way to change is: Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.applicationHost/sites/site[@name='Default Web Site']" -name "serverAutoStart" -value "False" but ...


3

The value of a second CPU depends entirely on your load. In the case of a typical small business web server, a dual CPU system will likely not give you any performance increase. For a database - well, it really depends on the database and your query types and load. A typical website won't make much use of the CPU. Think of a DUAL CPU server as a server ...


3

First, MX records are not SRV records. Second, he's absolutely right. I deal with this issue quite often with one of my clients that also hosts Exchange for their clients. Outlook needs to find autodiscover information that points to the Exchange server. The problem with having a wildcard record is that it causes autodiscover.domain.com to resolve to your ...



Only top voted, non community-wiki answers of a minimum length are eligible